Change Auditor for Active Directory Protection

I would like to know exactly how CA integrates itself into protecting Active Directory from changes. For example, I protect an OrganizationalUnit. I see nothing in the security settings for the OU regarding my protection. Somehow, CA is like the "man in the middle" which protects my object from changes.  Having read the superficial user guides and manuals, the process is not explained.  I would apprecate it if someone could either explain this to me in detail or point me in the direction...

 

How Change Auditor manages security specifically. Does it query for members of a given group? Does it perform an LDAP call, or a DirectoryServices call?

 

How does Change Auditor’s event handler really work? It sits on top of the event stack, but how does it accomplish that? What dependencies does it require to accomplish this?

 

Regards,

Waldo